6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe
Size 17KB
Sample240531-mlhr1sfd73
SHA256 6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be
MD5 0da917adef3683899f40d52391f541eb
SHA1 34bd5a08b3eaeede3f1db80d8cc5a9c5c17ccf28
SHA512 79fda6e4e86b288c6a2f26d925a60f8f0b29b3427f32b4d477b531bbcade3d992fc70a9bb8bcb644c5019dfbdfdb19d3cb8528dfe9c00f5836a419a1a7c763cb
SSDEEP 384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/Tqx8z:IMAQ+BzWPEwnE+KHM2/TyE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4160	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	svhost.exe
File created	C:\Windows\svhost.exe	6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe
Token: SeDebugPrivilege	4160	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4160	2236	6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe	83
PID 2236 wrote to memory of 4160	2236	6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe	83
PID 2236 wrote to memory of 4160	2236	6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe	83

C:\Users\Admin\AppData\Local\Temp\6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe
"C:\Users\Admin\AppData\Local\Temp\6f482428e8d48474eddad2c5e2c477507c233a2ddf3e042c763077ca9193d8be.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 340KB
SHA256 5ac17e3eb6889c8d70dd82563ce4794ed3ca9d3dbafa093ddce61f8200dedcd8
MD5 c97e53d5a843e4831e913f68c785c02e
SHA1 d0eca0e66323b03efb6bf757adf729ed94d9150f
SHA512 4a9f68dc3de06a769a0dc18142a792a00d4e34985f70c1d31b937ba58bf44d502eaa897d442b07cf564135c4bb5b58f69f9bef2a5caeed9c5ee9370d39ef9d74
SSDEEP 6144:thw+7FCeA0GnNWvJE1M7s9iFR5s0RXlVH6CkpBXFyN/NJ3xLIVUqA/AbkU:pIJExwagi3vPN6CG3mjhLdjrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

LclmSvyz64W4XBT.exe

Path C:\Users\Admin\AppData\Local\Temp\LclmSvyz64W4XBT.exe
Size 17KB
SHA256 0ca66a2d00cc6fedd24db21fcb33527026ee52fce947a2a2d36cbc4b7781949f
MD5 accaf54978344573783546d295e7ee8f
SHA1 8203632df4bfebfaa367295d0e8dea9a21908a84
SHA512 ed7ec32e0e818ba3379eace8bc248df0618580472a599369b721448dae1e8029bdd209f3cda66a047d38b40f04aac202ca1a171bef5864952a5319c73826569c
SSDEEP 192:nx+uPBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/f5:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Windows\svhost.exe
Size 16KB
SHA256 07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
MD5 76fd02b48297edb28940bdfa3fa1c48a
SHA1 bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA512 28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0
SSDEEP 192:nx+uPBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads